6.9 Multiple Login Checking

The number of sessions a user can have open simultaneously can be
restricted by setting Simultaneous-Use attribute in the user's
profile LHS (see section Simultaneous-Use). By default the number
of simultaneous sessions is unlimited.

When a user with limited number of simultaneous logins authenticates
himself, Radius counts the number of the sessions that are already
opened by this user. If this number is equal to the value of
Simultaneous-Use attribute the authentication request is
rejected.

This process is run in several stages. First, Radius retrieves the
information about currently opened sessions from one of its accounting
databases. Then, it verifies whether all these sessions are still
active. This pass is necessary since an open entry might be a result
of missing Stop request. Finally, the server counts the
sessions and compares their count with the value of
Simultaneous-Use attribute.

6.9.1 Retrieving Session Data

Radius retrieves the list of sessions currently opened by the user
either from the system database (see section System Accounting), or from
the SQL database (see section sql Accounting). The system administrator
determines which method to use.

By default, system accounting database is used. Its advantages are
simplicity and ease of handling. It has, however, a serious
deficiency: the information is kept in the local files. If you run
several radius servers, each of them has no easy way of knowing about
the sessions initiated by other servers.

This problem is easy to solve if you run SQL accounting
(see section sql Accounting). In this case, each radius server stores the data in
your SQL database and can easily retrieve them from there.

To enable use of SQL database for multiple login checking, do the
following:

In your ‘raddb/config’ file set:

mlc {
method sql;
};

In your ‘raddb/sqlserver’ file, specify the queries for
retrieving the information about open sessions and, optionally, a
query to close an existing open record.

There are two queries for retrieving the information:
mlc_user_query returns the list of sessions opened by the user,
mlc_realm_query returns the list of sessions opened for the
given realm. Each of them should return a list of 4-element
tuples(4):

Apart from these two queries you may also wish to provide a query for
closing a hung record. By default, radiusd will use
acct_stop_query. If you wish to override it, supply a query
named mlc_stop_query, for example:

6.9.2 Verifying Active Sessions

Whatever database radiusd uses, an open entry in it does not
necessary mean that the corresponding session is still being
active. So, after retrieving the information about user sessions,
Radius verifies on corresponding NASes whether these are actually
active.

For each entry in the session list, if its NAS acknowledges the
session, the session count is incremented. Otherwise, such entry is
marked as closed in the database and is not counted.

There may also be cases when the NAS is unreachable due to some
reasons. In such cases the Radius behavior is determined by the value
of checkrad-assume-logged in ‘config’ file
auth statement (raddb/config). If the value is yes,
Radius assumes the session is still active and increases the session
count, otherwise it proceeds as if the NAS returned negative reply.

To query a NAS, Radius first looks up its type and additional parameters
in ‘naslist’ file (see section NAS List — ‘raddb/naslist’). There are two
predefined NAS types that cause Radius to act immediately without
querying tne NAS: the special type ‘true’ forces Radius to act
as if the NAS returned 1, the type ‘false’ forces it to act
as if the NAS returned 0. If the type is neither of this predefined types,
Radius uses it as a look up key into the ‘nastypes’ file
(see section NAS Types — ‘raddb/nastypes’) and tries to retrieve an entry which has
matching type. If such entry does not exist, Radius issues the error
message and acts accordingly to the value of configuration variable
checkrad-assume-logged. Otherwise, Radius determines the query
method to use from the second field of this entry, and constructs method
arguments by appending arguments from the ‘naslist’ entry to
those of nastypes entry. Note, that the former take precedence over the
latter, and can thus be used to override default values specified
in ‘nastypes’.

Having determined the query method and its argument, Radius queries
NAS and analyzes its output by invoking a user-supplied
Rewrite function. The function to use
is specified by the function= argument to the method. It is
called each time a line of output is received from the NAS (for
finger queries) or a variable is received (for SNMP queries). The
process continues until the function returns 1 or the last line
of output is read or a timeout occurs whichever comes first.

If the user-function returns 1 it is taken to mean the user's session is
now active at the NAS, otherwise, if it replies 0 or if the end of
output is reached, it is taken to mean the user's session is not active.